You're struggling to find the right SIEM software for your security challenges. What are your options?

Security executives must ensure that security goals are aligned with business needs to improve the productivity, efficiency, and effectiveness of both the business and security ecosystem. So, when selecting the SIEM (Security Information and Event Management) solution you should consider that. Security analysts rely on the results and alerts generated from this logging system to perform their information security tasks. The objective of having a SIEM solution is to build a SOC or possess a tool that can gather logs from various systems that generate security logs for further analysis. Additionally, SIEM monitors compliance with certain standards or frameworks. SIEM typically gives an image of the security posture and hygiene.

Pour ma part, le choix du SIEM est avant une étude de qui va manoeuvrer la solution ? Car cela prend un temps conséquent d'analyser des logs, traiter, classifier et effectuer le rapport par la suite. Il est fort clair que la partie budgétaire sera prise en compte quant au choix de la solution, vu que cela se repose sur la partie Business, également.

You have to define your goals. You can use SIEM for: 1. Regulations 2. Audits (Both internal and external) 3. Compliance 4. Threat Detection and Security Monitoring 5. Incident Response 6. Both of them After defining goals, you need to know the technical requirements of those goals, such as: 1. Do you need real-time detection/correlation, or is periodic/search-based enough? 2. What is the required log retention period for hot, online logs, and archived logs? 3. What is the maximum EPS (Events Per Second) according to your goals? 4. UEBA (User and Entity Behavior Analytics) requirements? Your goals should include cost considerations, maintenance, and technical skill requirements.

Ao buscar o software SIEM adequado para desafios de seguran?a, considere op??es líderes no mercado, como Splunk, IBM QRadar e Elastic Security. Avalie suas necessidades específicas, como escopo de implementa??o, integra??o com fontes de dados, escalabilidade e recursos avan?ados de análise de amea?as. Analise as capacidades de correla??o de eventos, detec??o de anomalias e automa??o de resposta. Além disso, leve em conta a usabilidade, o suporte oferecido e as atualiza??es regulares para garantir uma escolha que atenda efetivamente às demandas dinamicas do ambiente de seguran?a da sua organiza??o.

In my opinion, the best choice depends on your specific needs and budget.Evaluate each option based on factors such as scalability, customization capabilities, integration with existing systems, ease of use, and budget constraints to determine the best fit for your organization's needs. Some popular SIEM solutions include, Microsoft Sentinel, Splunk, IBM QRadar, LogRhythm. Additionally, consider consulting with cybersecurity experts or conducting proof-of-concept trials to assess the effectiveness of each SIEM solution in addressing your specific security challenges.

CONTRIBUTION #34 After defining the scope, it's crucial to specify all data sources. Various methods can be employed for data collection, such as agents, agentless approaches, API-based integrations, or syslog for CFE (Common Format Events). It's essential to consider the management of agents and API keys during this process.

Log collection methods such as Syslog, SNMP, Netflow, Packet Capture, Text, JDBC/ODBC, Agents, and API (Both Cloud and on-prem) must be considered, as well as log formats like JSON, XML, CEF, LEEF, and proprietary log formats. The volume of data sources plays a critical role here. The requirements to handle 2500 EPS and 15000 EPS may differ significantly in terms of stability and system requirements such as disk usage, RAM, and CPU requirements

Un autre point de vue à prendre en considération, qui reprend légèrement mes propos susmentionnés; manoeuvrer un SIEM est quasi un travail à plein temps et par conséquent, demande de la charge humaine. C'est la raison pour laquelle qu'il faut bien réfléchir sur le fait d'implémenter une telle solution, d'autant plus que cela prend un volume de stockage également conséquent sur base de la taille du parc (nombres de pc, serveurs dont l'agent du SIEM sera installé) et les logs qu'on désire parser, analyser, etc.

Integration is a crucial factor that sets different vendors apart in terms of leveraging logs generated from all systems. Some vendors may present difficulties when it comes to integrating certain systems with your SIEM solution, while others like Splunk offer more flexibility. In my experience, there can be a potential challenge when deploying an SIEM solution on-premise and attempting to extract logs from cloud solutions such as Cisco Umbrella, which can be a complex task.

Na minha experiência como provedor de solu??es e muito comum que clientes possuam predile??es de solu??es que é um erro, pois entender as fontes de dados é um dos principais pontos de sucesso, exemplo: Se o cliente é um forte usuário da plataforma Azure, office 365 e forte ado??o Microsoft o uso de MS-Sentinel e uma ótima op??o para acelerar o a maturidade do SOC com resultados expressivos em curto prazo incluindo comportamento de usuários e outros ganhos como integra??o com DLP, CASB, Firewall e ambiente de servi?os e servidores em cloud Azure. Se seu foco é analise de comportamento financeiro em aplica??es solu??es como Splunk pode ser uma alternativa, ou mesmo em caso de Open source como elastic searh devem ser consideradas.

CONTRIBUTION #35 Cost estimation is paramount in this context. From experience, implementing a SIEM involves hidden costs, encompassing both CAPEX and OPEX. Some SIEM providers offer a one-month trial to test full SIEM functionalities, providing an empirical understanding of the expenses involved and aiding in budget provision. Hidden costs also encompass considerations such as data retention and determining the optimal storage tier: hot, warm, or cold. These factors can significantly impact overall expenses and should be carefully evaluated during the planning phase.

The main functions of SIEM solutions include data aggregation, data normalization, threat detection, threat intelligence, security alerting, compliance assessment, and reporting. When selecting an appropriate SIEM solution, it's important to also consider the new capabilities offered by next-generation SIEM, such as AI, UEBA, and SOAR. These capabilities automate attack timelines, reducing the need for human effort and decreasing the time needed to identify malicious activities, resulting in fewer false positives. This can make investigation and incident triage much faster.

Thoroughly compare available SIEM tools, focusing on functionality, scalability, user experience, and cost-effectiveness. Key features like data normalization, threat analysis, and incident response capabilities should be scrutinized. Utilizing comparison tools and reading customer reviews provide invaluable insights into each product’s practical application. This step is critical in ensuring you choose a SIEM tool that not only meets your current requirements but is also poised for future security challenges.

To ensure that a Security Information and Event Management (SIEM) system can effectively consolidate security events from various sources within your IT network, it's crucial to request a Proof of Concept (POC) or pilot project from the vendor. By doing so, you can validate the SIEM's ability to provide valuable information through its dashboard that can aid in the speedy detection and response to security incidents.

CONTRIBUTION #36 Going from the BUILD phase to RUN phase may conceal numerous misconfigurations such as ineffective detection or analysis rules within the system. It's crucial to conduct a thorough review of IAM (Identity and Access Management) requirements, as many applications and services necessitate access grants. Analysts also require appropriate access and permissions to perform their tasks effectively. Initiating with a trial period of one month or implementing a Proof of Concept (POC) can help navigate challenges and ensure the smooth operation of the SIEM, possibly starting with the SIEM running in cold mode.

A melhor solu??o n?o será eficiente sem a melhor equipe, antes de pensar em solu??o o quanto a sua empresa esta disposta em investir no aprimoramento contínuo da equipe ? Muitas vezes a escolha de um parceiro com experiencia pode ser o melhor caminho, pois o parceiro tem o foco em treinar, capacitar, desenvolver e se atualizar em um mundo em constante mudan?a, além de ter um processo contínuo de melhoria e controle que deve ser apresentado recorrente com plano, prazos e execu??o.

Never purchase a solution without performing a proper Proof of Concept (PoC). Most sales team are trained to tell you what you want to hear. My experience with this was on a phase where our senior director wanted to close a deal on a "Next Generation SIEM" that learns the behavior of your organization and create rules by itself. Finding this solution a bit strange, we convinced him to give us a month on a PoC and test the solution. We ended-up not closing the deal as it delivered less than 20% of it promises.

Pour éviter un nombre accrut de faux-positif, il est nécessaire de durcir les systèmes sur lesquels les agents du SIEM seront installés. Car effectuer de l'agrégation de logs sur des systèmes troués (désolé du terme) augmentera significativement le nombre de faux-positif. Pour récapituler: - Etudier les besoins, la charge humaine et les compétences pour utiliser une telle solution - Une cartographie plus matrice de flux seront un excellent support. - S'assurer que nos assets soient suffisamment durcis pour remonter des valeurs, des données de haute qualité, dès lors, plus fiable (cela facilite dans les phases d'analyse, classification, etc.) -

SIEM operation and management is an ongoing process that requires continuous attention and refinement. It involves not only the initial deployment and configuration of the SIEM solution but also the day-to-day activities necessary to ensure its effectiveness in detecting and responding to security threats.

Independente da solu??o escolhida a manuten??o é o principal fator de sucesso, a atualiza??o dos casos de uso, desenvolvimento de novas regras adequando a necessidade da sua opera??o do seu negócio, pois a redu??o de falso positivos e o aprimoramento com base Mittre é uma das maneiras, sem contar com o processo de teste RedTeam e contribui??o direta com BlueTeam no aprimoramento dos controles e ajustes das ferramentas de resposta e automa??o reduzindo a superfície de ataque e amplia??o dos sensores.

You should not rely 100% on tools and technology to protect your environment. Most SIEM solutions are straightforward on its objectives and what delivers, but you need to have a team that can also support, tune/enhance and monitor the SIEM. It's a complex solution that requires knowledge not just on the tool itself but also to create the right detection rule. The risk is too high and it's easy to leave gaps in the environment

Vendor Support and Integration: Investigate the level of support provided by the SIEM vendor. A responsive and knowledgeable support team is essential for effective problem resolution. Additionally, assess how well the SIEM integrates with your existing security infrastructure, tools, and third-party applications. Compatibility and smooth integration can enhance overall security operations.

Avalie a capacidade de personaliza??o para atender às demandas específicas da sua organiza??o. Verifique se a solu??o oferece integra??o com outras ferramentas de seguran?a e conformidade. Analise as op??es de suporte técnico e treinamento disponíveis. Considere também a escalabilidade para garantir que o software possa acompanhar o crescimento da sua organiza??o. Uma avalia??o completa, alinhando as características do software com as necessidades específicas, ajudará a tomar uma decis?o informada.

Assess Scalability and Flexibility: Beyond the mentioned steps, it's crucial to evaluate the scalability and flexibility of the SIEM solution. Ensure it can accommodate the growth of your organization and adapt to evolving security needs. A solution that scales seamlessly with your business and offers flexibility in deployment options (cloud, on-premises, hybrid) will be more sustainable in the long run.

Compliance Requirements: Consider your industry-specific compliance requirements. Different sectors have distinct regulations and standards (such as GDPR, HIPAA, or PCI DSS), and your SIEM solution should help you meet these compliance needs. Ensure that the SIEM platform provides reporting features and alerts tailored to the compliance standards relevant to your organization.